A critical Server-Side Request Forgery vulnerability in WWBN AVideo allows unauthenticated remote attackers to bypass security controls and access internal network resources.

The vulnerability exists in the proxy.php endpoint, which fails to re-validate redirect targets after the initial URL check. This allows an unauthenticated attacker to manipulate the application into fetching content from private RFC1918 addresses or cloud metadata services.

The ability to perform SSRF poses a significant risk to organizational security, as it allows attackers to probe internal infrastructure that is otherwise protected from the public internet. With a CVSS score of 8.6, this flaw could lead to the exposure of sensitive internal data, cloud credentials, or administrative interfaces, potentially resulting in full system compromise or lateral movement within the network.

Immediate Action: Update WWBN AVideo to version 26.0 or higher immediately to apply the necessary redirect validation logic.

Proactive Monitoring: Review web server access logs for anomalous requests to the proxy.php endpoint, particularly those involving unusual redirect patterns or internal IP address ranges.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block or inspect outgoing requests from the server to restricted internal network segments.

Public Exploit Available: Unknown

Given the high CVSS severity and the confirmed existence of proof-of-concept material, organizations running WWBN AVideo must prioritize this update. Failure to patch allows attackers to bypass perimeter security, making the application a potential gateway for deeper network infiltration. Apply the version 26.0 update immediately to remediate the underlying validation failure.